How should activity monitors be evaluated?
It is important, when evaluating both activity-monitoring and operation- restricting software, to judge the extent to which the operator is given the option of “allowing” an operation. It is also important, that the operator be informed, not only that a particular program or operation should be halted, but also why. There should not be too many false alarms generated by the software, and it would be helpful to have the option of “tuning” the software to be less, or more, sensitive to a given type of activity. It is very difficult to specify in advance what you should check for in activity-monitoring software, since the developers are loath to state, in detail, exactly what the program will be checking for. (This reluctance is understandable: if a developer “advertises” exactly what the product checks for, virus or trojan writers will simply use another route.) In addition, the work or computing environment must be considered, as well as, in certain cases, the corporate climate. Activit
